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Herman Kahn, my onetime pal at the Rand Corporation, invented the concept of the 
Doomsday Machine: a system rigged to destroy all life on earth, known to be triggered 
automatically by the occurrence of some event on a published menu of actions meant to 
be deterred, such as one or several nuclear explosions on US territory. He claimed to 
have suggested it only to show that deterrence alone wasn’t an adequate criterion for our 
nuclear weapons systems. If all other considerations were neglected, except cost, you 
could be led to an extreme solution where, he originally supposed, no reasonable person 
would want to go. 

Various forms of Doomsday Machines, he conjectured from his background as an applied 
physicist, would be both feasible and easily affordable, and they would surely maximize 
deterrence of the proscribed actions. But they were “obviously”—he thought initially— 
unacceptable on a number of grounds: too automatic, lacking in human control or 
override (which was what made them maximally “credible” as deterrents, but, he 
presumed, at an unacceptable risk), too liable to false alarms, and excessively, 
irreversibly destructive. Obvious as this seemed to him, Herman had to acknowledge that 
when he tried this “thought experiment” out on many of his colleagues, a few of his 
engineering friends were quite taken with the idea, and started making preliminary design 
calculations. 1 

But alone at Rand, so far as I knew, I discovered soon after this that the United States 
had already constructed something very close to Herman’s conceptual machine. In fact, 
for reasons no one knew at the time, what the Air Force and Navy under President 
Eisenhower had installed and were operating was, not by design but inadvertently, a 
Doomsday Machine, in the most literal sense. Any one of a number of events—a 
nuclear explosion on Washington was just one of these—would have triggered with 
virtual certainty thousands of thermonuclear explosions elsewhere, mostly on or near 
cities. 

That much was planned, at one level or another, though not comprehended or intended at 
any one seat of authority so far as I could tell; I suspected no one understood both the 
target system and the degree of automaticity. The immediate result would be to kill, by 
blast and fire and fallout, more than half a billion people. But other effects, never 
calculated nor understood for another quarter of a century, could have led to the 
extermination of all humans and large animals and most forms of life on Earth except for 
certain grasses, cockroaches, flies, mosquitoes and bacteria. 
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END NOTES 


' [That wasn’t just one of his jokes. I found myself reading a Rand “P,” (for Paper) a 
blue-covered document meant for unclassified distribution, by one of his disciples 
entitled “The Design of a Doomsday Machine.” It sketched out nine or ten ways one 
might destroy all or most life on earth, some of them by harnessing the energy of large 
thermonuclear explosions to produce environmental or ecological catastrophes, such as a 
giant tidal wave, or by seeding the explosives with long-lived radioactive poisons like the 
cobalt bombs of “On the Beach.” 

It was the first time I’d seen at Rand a study that I didn’t think should have been done at 
all, by anyone anywhere, it shouldn’t exist. But I was especially shocked that a colleague 
would think of distributing this as an unclassified paper. (Nearly everything we wrote at 
Rand, except for the Social Science division and professional papers people wrote on the 
side in their academic specialties, was classified, mostly “Secret”). This I thought should 
be Top Secret, if it were to exist at all, which meant it would have very limited 
distribution even at Rand, though we all had Top Secret clearances. But my colleague 
was adamant against classifying it; he insisted all of his calculations had been made from 
open sources. I thought he was crazy, and told him so.] 







